I am the same The paper wallet method is way easier to fail than the hardware wallet method.
It is exactly, if you don't know what you are doing. However if you know a bit about security and technology, it will be very simple to do safely.
Even if the script used to generate was malicious, if it cannot store data and submit it online, then the malicious part of the code cannot do anything.
I'll give you an example:
Peter boots off linux live CD on a computer without internet connection and hard drive. He runs the website script for generating paper wallet. However the script has a line that sends the generated private key to server, but as the script cannot save anything on the hard drive, it cannot submit them online as Peter's computers is detached from the internet and does not have any kind of storage media.
End of the story, however it would be theoretically possible to save some kind of file to do this if executed on the Live CD for example. Hardware wallets (with screens) are certainly the best opinion for people without the needed technical knowledge because generating a private key on infected PC would basically cause all of your funds to a very likely possibility of their funds getting stolen. This is the reason why you need to be airgapped while doing it, on a fresh distro without anything downloaded to reduce the risks to minimum.
Good advice was ordered by Trezor and it works great
Great to hear that!
but for now I have everything in ETH I understand that this is Wallet on BTC anyway? That's how it works?
Not sure if Trezor supports ETH natively, but you can use MEW with the guide found from here:
https://blog.trezor.io/trezor-integration-with-myetherwallet-3e217a652e08The transactions are always signed on the trezor, rather than the website of MEW. However always remember when sending ETH to check the transaction on your Trezor before Signing & Broadcasting it. It is possible for malicious code to send an wrong request to your Trezor, and if you do not check carefully the details, it might end up in the wrong address.
Ps. If sending tokens, the destination address is the contract address so you will have to find another way to verify that this is the transaction that you indeed want to send.